Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape backslashes for MySQL and MariaDB quoted contexts. The vulnerable surface is public and embedded dashboard/chart requests that call applyMysqlOrPostgresVariables. An unauthenticated user sends crafted URL filter values to a public or embedded chart backed by a stored SQL query. Replacement-string dollar sequences can alter SQL independently of the database engine, while MySQL and MariaDB backslash handling provides a second quoted-string escape path. The target must expose a public or embedded chart using URL-controlled variables in a SQL query; only the backslash branch is specific to MySQL and MariaDB. Injected SQL can read, modify, or delete data available to the configured database account. This issue is fixed in version 5.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T21:17:08.947Z",
  "pubdate": "2026-11-06T21:17:08.947Z",
  "executiveSummary": "Chartbrew versions prior to 5.2.1 contain a critical SQL injection vulnerability within its dashboard-variable substitution mechanism. This vulnerability allows unauthenticated, remote attackers to execute arbitrary SQL commands against backend databases connected to the application.\nThe flaw stems from unsafe processing of user-controlled variables in SQL queries, specifically within the applyMysqlOrPostgresVariables function. By crafting malicious URL filter values for public or embedded charts, an attacker can manipulate the query structure, potentially leading to unauthorized data exfiltration, modification, or deletion.\nThis vulnerability is particularly severe as it affects the public and embedded dashboard surfaces, which are frequently exposed to the internet without requiring authentication. Exploitation enables an attacker to interact with the database using the same privileges as the database account configured within Chartbrew. Immediate remediation is required via upgrading to version 5.2.1 or higher.",
  "technicalDetails": "The vulnerability originates from the improper handling of user-supplied input during the dashboard-variable substitution process. Specifically, the function 'applyMysqlOrPostgresVariables' is susceptible to two distinct exploitation vectors that facilitate SQL injection.\nFirst, the application uses unsafe JavaScript replacement strings to substitute variables within SQL queries. By leveraging dollar-sequence substitution patterns in the replacement strings, an attacker can manipulate the resulting SQL query structure, circumventing intended query logic.\nSecond, a specific flaw exists in the handling of backslashes when interacting with MySQL and MariaDB databases. The application fails to properly escape backslashes within quoted contexts, which allows an attacker to break out of string literals or inject control characters that alter the execution flow of the SQL query.\nThe attack flow proceeds as follows: 1. An attacker identifies a public or embedded chart in Chartbrew that utilizes URL-controlled variables within a custom SQL query. 2. The attacker crafts a malicious payload containing either specific dollar-sequence tokens or backslash-escaped characters tailored to the backend database engine (MySQL/MariaDB). 3. The attacker submits this payload via URL filter parameters to the public-facing chart endpoint. 4. The 'applyMysqlOrPostgresVariables' function processes the input unsafely, injecting the attacker's SQL syntax into the query execution. 5. The backend database executes the modified query, returning unintended data or performing unauthorized data manipulation.\nBecause this vulnerability affects public and embedded charts, no authentication or privileged access is required for exploitation. The network exposure is broad, as any internet-facing Chartbrew instance with these features enabled is vulnerable. The potential impact is significant, as the injected SQL is executed with the privileges of the database user configured in the Chartbrew connector, which may have permissions to read, update, or delete sensitive business data, depending on the environment's configuration. This flaw was remediated in version 5.2.1 by implementing robust input sanitization and secure parameter binding patterns."
}